Open, and logging new jobs · weekdays, 9am–5:30pm Phone is quicker: 0800 6890668
HDR Hull Data Recovery 0800 6890668 Price it up
HDR / Evidence and legal work / Staff conduct and exit investigations

Hull and East Riding employers · evidence from work devices

Workplace investigations, Hull. Files leave quietly; the machine writes it down.

If a laptop returned in good condition is then reviewed, it is likely that some interesting items will be discovered. Windows retains a history of its activities (as do the sync clients), even after a user performs a "clean-up" of their files. A rule set up within the inbox to forward all emails received to a personal email address. A USB flash drive inserted into a Windows machine at 22:40 on a Friday evening. All files deleted from the Downloads folder on the morning of the exit meeting. You take the laptop out of service; we image it to evidential standards and document what was found for both Human Resources and your solicitor.

Reports in the form CPR Part 35 requires Each handover logged Neutral and discreet

Ring us, in confidence
0800 6890668

What the disk kept a note of.

What Windows logs about USBAll removable storage devices plugged into any Windows based computer are recorded (including the serial number of the device) along with the date/time it was connected and for how long. Any device appearing in the system log for the first time at 02:00 on a Sunday, several days before a person resigned, requires explanation.
Cloud storage and webmailRegardless of which cloud storage service the employee uses (OneDrive, Dropbox, Google Drive or even accessing their webmail through a browser), traces remain on the machine. This includes synchronised database entries, cached access tokens, web browsing histories and partially completed file uploads. Logging off and cleaning up afterwards will not remove most of this information.
Wiping tools and bulk deletionRemoving evidence usually creates much more of it. At minimum, you will be left with the name of the tool used, the date/time it was executed and, ultimately, anything that the tool was unable to delete, which is usually what settles matters.
Sequence is the evidenceEach of these items individually likely has an innocent explanation readily available. However, if viewed collectively while tracking the timing of events (i.e., files gathered, memory stick inserted, upload completed, wiping performed), it is less likely to appear as mere coincidence.

Settle the legal basis first.

Not one of these? Ring us →
What is in playWhat it puts on youHow we work within it
Data Protection Act 2018 and UK GDPRHaving ownership of the device alone does not provide you with any lawful basis for examining the contents of the device. Select one lawful basis, usually legitimate interests, and complete the necessary balancing test. Before commencing the examination process, document your justification for doing so.Our examinations are limited to only those areas related directly to the allegations presented to us and cease once those issues have been addressed.
Guidance from the ICO regarding monitoring workers, October 2023.Transparency should always be the presumption for any monitoring. In cases involving a high level of risk, completion of a Data Protection Impact Assessment (DPIA) is required.The relevant company policies will be reviewed prior to analysis being conducted on any disks. We will clearly indicate whether a DPIA is deemed to be required as part of our documentation.
Covert examinationOnly in extraordinary circumstances (a suspected crime or serious misconduct) will a search be authorised. No action can be taken without approval from senior management.There is no imaging/reading of any kind until written approval from senior management is in hand.
ACAS standards apply.Any disciplinary decision must be based on a fair, proportionate enquiry.The results of the investigation are presented as found, regardless of who they may assist.
Weight at tribunal.Evidence is only as good as the method used to obtain it.A chain-of-custody log that will strengthen your case and not provide an opportunity for the opposition.
Sending it to us: Get a price quotation prior to sending, via telephone or using the form. Send it to the Leeds intake lab by post. Postage should be insured and traceable. Alternatively drop it off there in person, Monday to Friday, 9am to 5:30pm, with no appointment needed. Return postage will be paid by us. Call us prior to sending if you would like us to check the packing with you. All details are contained within the posting page.

The stages, one by one.

The casebook in full →
01

First a confidential call, then a price in writing Free

This commences with a confidential discussion, and there is no cost involved. These three elements will define the remainder of our work together: What happened? How extensive is this issue (machines, accounts etc.)? And what does the data/evidence need to prove? Together these three factors establish the scope. The scope defines the fixed fee. You have this fixed fee in writing prior to any equipment being examined.

Held in confidenceOne price, put in writingWhat has to be established
02

Take the machine out of use

It's safe to say most evidence disappears within two weeks and rarely at the hands of someone trying to delete it. IT will also rebuild the computer for use by an incoming person. The drive is generally placed into the storage area. In addition to this, a supervisor will review it once for themselves. An initial write-blocked image takes precedence over each of these.

Imaged at the startBefore anyone else gets it
03

Trace how it left

Once this point has been reached the copy will manage everything while the original remains untouched. All removable media drives are listed with their date inserted, along with the length of time each remained connected to the system. Additionally, there are timelines for any data that was transferred to a personal cloud account or sent via email, any deletion of data, and whether or not a wiping application ran. There is one timeline which combines all of them.

Every route out examinedDeletions given a timestamp
04

Put it in writing

The report is intended to be read by a lawyer, an HR panel or a tribunal, not by an IT engineer. The document evaluates our actions based upon the ICO guidelines for monitoring employees, and based on the expectations of a fair inquiry as defined by ACAS. If the matter proceeds to the police, the conclusions reached during the investigation remain unchanged.

Written for the tribunal bundleWithin ICO and ACAS bounds
05

Exhibits, logs and every hash

Reports that cannot be tested will be worth little. Therefore, the bundle includes all of the work: exhibits, images, logs of handovers, hashes of everything and notes taken at the time. A third party (the opposing side's expert) can simply repeat our process and reach the same point we reached.

Conclusions, with exhibitsHashes on file, movements loggedOpen to being checked

What we see on the bench

  • More cases are wrecked by normal IT activity than any intentional cover-up: once the computer has been reissued to the next user, the evidence leaves with it.
  • The findings cannot be edited: when you present your findings to a tribunal they know whether you have manipulated them or not. If you have, you will have paid for nothing. The written word is what you receive.
  • In terms of percentages in trade publications, they're soft: the count of how many departing employees are transferring information out of the organisation can range from a third upwards; who sponsored the research usually determines the percentage. The behaviour is certainly present. The decimal points used represent nothing other than advertising.
  • Employee ownership of a device is a separate issue: in order to access the employee owned device we would need either explicit consent or clear legal grounds prior to touching it. This is decided upon during our first conversation regarding your needs, rather than midway through the work.

We quote one number: a 2013 Symantec study conducted jointly with the Ponemon Institute reported that approximately half of individuals who had recently changed employers acknowledged retaining some form of confidential information from their previous employer. Almost all subsequent research originated from entities attempting to sell something. As such, the numbers do not correlate with each other. In reality, our own experiences are far less exciting than those previously stated: generally speaking, if an employer provides us with details of what they believe was taken, rather than being uneasy in general, we subsequently confirm their suspicions through the artefacts themselves.

One case from the casebook.

HU · HUL-2026-0539LOGGED ✓

Files went out twenty days before the resignation

An employer from Bridlington presented a rival's pitch deck and very little else. The timing alone established the outcome: twenty days prior to the resignation letter being sent was the date of the last upload. On the employer's company laptop, the files were grouped together into one folder, thereafter the employee created a personal cloud account and uploaded the files thereto, in that exact order. The matter was resolved by way of undertakings.

Closed with undertakingsChronological record written up in 7 days

Before you box it up.

Do these first

  • Shut it down. Then lock it away in a drawer.
  • Leave the email and cloud accounts operational: closing them will result in deleting evidence.
  • Determine what the acceptable-use policy issued to employees actually told them.
  • Do nothing covertly unless authorised to do so in writing by senior management.

What not to do

  • Reuse the device with another employee.
  • Reviewing the contents of the folders on your own.
  • Speak with the departing employee before securing their device.
  • Conduct covert surveillance without having a valid reason in writing

What we get asked on the phone.

The company owns the laptop. Can we search it?

Having ownership of the equipment has little to do with it. In order for the organisation to lawfully monitor employee use of company resources (i.e., computers), there has to be a lawful basis, and employees must have already been notified through their acceptable-use policy about monitoring. If no notification occurred, anticipate a fight on this point. Silent searches will not occur except when the organisation suspects criminal activity and will require authorisation by a director of the company.

Can we watch someone without telling them?

Almost never, and it is not practised as standard procedure. The ICO has reserved for use in "exceptional" cases (e.g., suspected crimes or gross misconduct) covert surveillance of employees as outlined by the agency in its 2023 guidance document titled Monitoring Workers. However, even under those conditions, it expects authorisation from senior managers; completion of a DPIA; a limited scope; and documentation of why.

A leaver may have copied files. What first?

Preserve first. Shut down the machine. Lock up the machine. Leave the mailbox and cloud accounts open so they continue to run. Do not disable the mailbox and cloud accounts. No-one opens a folder until a forensic copy has been made. Any timestamps on the disk indicating when items were removed will be overwritten by an honest look round the disk.

What will a tribunal make of all this?

It is not just about what you find; how you got there counts just as much. Once the route to a finding can be dismantled, a damaging finding stops being damaging. A screenshot is useful only if a lawful basis existed for taking it, only if the search stayed within the suspicion which prompted it, and only if each step of the process was documented.

What people read after this.

Forensic recovery → Reports for the court → Deleted by mistake → Forensics and evidence →

Captured quietly now, not disputed later.

Evidence that has been preserved from an early time and handled correctly will be much harder to deny or dispute than evidence that was viewed quickly after everyone knows the problem. Log a job. The first view costs you nothing and everything you tell us will remain confidential.

0800 6890668

Price it up How to post it to us